63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
Size 55KB
Sample260910-1bh7pawfph
SHA256 63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8
MD5 d342298841eea428de14431072e9e12f
SHA1 da185af1c9c5aa490d36adc7329ea06e6c334a30
SHA512 86754762a4abf86320c3cf5955c02b8dec40fc8159ecc37769acf34bda1a94706cf3f8f344b1ec6a475c88fb79d57d19b983e629620829d86ebb02e4fd85d3ba
SSDEEP 1536:fhBZ1b9c409y1G1i35Bo01i/gcU8eVTOK/YqjYYamvbtb9:nZl2zoxV1i/NU82OMYcYYamv5b9
TLSH
T14943F13AD629049AE3D5BE318CA66E30131BE3634172039F645CB476DDAF3537247768
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence spyware stealer upx

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0XC6A98-A14C-J35H-46UD-F5AR862J2AH5}\StubPath = "C:\\system.exe"	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\SysWOW64\ie.bat	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
File created	C:\WINDOWS\SysWOW64\qx.bat	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4272	cmd.exe
1524	cmd.exe
4060	cmd.exe
4612	cmd.exe
2120	cmd.exe
4348	cmd.exe
3440	cmd.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5036-0-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral1/files/0x00070000000245a3-15.dat	upx
behavioral1/files/0x00070000000245a4-16.dat	upx
behavioral1/memory/5036-17-0x0000000000400000-0x0000000000429000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\windows.exe	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
File opened for modification	C:\WINDOWS\windows.exe	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
File opened for modification	C:\WINDOWS\windows.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1686437038"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00d7afc67341dd01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277419"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10aba8c67341dd01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8FBC1347-AD5E-11F1-BC3D-7A3BE15C66E4} = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "495840682"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1690343092"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea96990f6880ef41809c1d010f1d816500000000020000000000106600000001000020000000779a77e81a80be3356f5d625def9c97e8cd0f7508e5980cb44c94d22f809d3a7000000000e80000000020000200000001835891015ab97a0473d1715470b400c758485fe613c23c29efb900acc427ecb200000003417bc864555aeb19b21a7da1a85454ddeaf129f7d46f4f699100e49a0031e00400000004cd1d6229d6226a00a196e5d525961a256257ef62b565823ec8f18ad2a248131ee4b19b648e997e153e72b151a08c0929d3b5aae6be56590433ab6fdd44f02fc	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ea96990f6880ef41809c1d010f1d8165000000000200000000001066000000010000200000001113094cb059c784313a64cd786c391ff49c2b4057dd19de2ea1f6a642edb58d000000000e800000000200002000000069f6ed1935551c4dbcaf542d2eebf3c27367b6e5be2144d927a2a49fdc9ac77320000000c9ccc0f488951d484cc45dfe21eededc8fc7105c8f0e0ef0cd7bff1bd2651aba4000000017fdd8aa5ddd96b40b6c9ee501fe095cb52de833d7d013e12d5f3ffb6f008f569cd093800764c8601a115e0f5c2d94cb106c4bce1e50e0399353e50d4a72ed01	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31277419"	IEXPLORE.EXE

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://dhku.com"	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4800	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
4800	IEXPLORE.EXE
4800	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE
1120	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4800	5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe	85
PID 4800 wrote to memory of 1120	4800	IEXPLORE.EXE	86
PID 5036 wrote to memory of 2408	5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe	87
PID 5036 wrote to memory of 4272	5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe	88
PID 4272 wrote to memory of 4224	4272	cmd.exe	90
PID 5036 wrote to memory of 1524	5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe	91
PID 1524 wrote to memory of 640	1524	cmd.exe	93
PID 5036 wrote to memory of 4060	5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe	94
PID 4060 wrote to memory of 4056	4060	cmd.exe	96
PID 5036 wrote to memory of 4612	5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe	97
PID 4612 wrote to memory of 4140	4612	cmd.exe	99
PID 5036 wrote to memory of 2120	5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe	100
PID 2120 wrote to memory of 412	2120	cmd.exe	102
PID 5036 wrote to memory of 4348	5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe	103
PID 4348 wrote to memory of 4024	4348	cmd.exe	105
PID 5036 wrote to memory of 3440	5036	63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe	106
PID 3440 wrote to memory of 3772	3440	cmd.exe	108

Views/modifies file attributes 1 TTPs 7 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4224	attrib.exe
640	attrib.exe
4056	attrib.exe
4140	attrib.exe
412	attrib.exe
4024	attrib.exe
3772	attrib.exe

C:\Users\Admin\AppData\Local\Temp\63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe
"C:\Users\Admin\AppData\Local\Temp\63746b474324b8a65aa84c0a30e69efb43904d83bffefcb2b4d8b0bac3e9d8f8.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.212ok.com/Gbook.asp?qita
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4800 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1120
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://www.ymtuku.com/xg/?tan
  2⤵
  - Modifies Internet Explorer settings
  PID:2408
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\All Users\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4224
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\桌面\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\启动 Internet Explorer 浏览器.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\Application Data\Microsoft\Internet Explorer\Quick Launch\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4140
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\Documents and Settings\Admin\「开始」菜单\程序\Internet Explorer.lnk"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:412
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "C:\WINDOWS\windows.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "C:\WINDOWS\windows.exe"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:4024
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c attrib +h "c:\system.exe"
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h "c:\system.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 055ffd93c2d3fd466d1f3aa1ee9108002901e49cbe657717b90931ae6a2e1d43
MD5 fbed877bd90147bbd0cdd6f5678f1f2a
SHA1 bbda3aeb14036ba873041bc1be7fd9ede0c662e6
SHA512 47fb87e06532096f73bb68ab1d6d59528d00a837684c7b2f39970ed59ae6805ad7111a05736b006e91eb071ec5f8061e2077a95e31217cb179d4b7439c8098fa
TLSH
T1BEF0D4C2E13DF5B21A6385DC125C45A53031643F1554455B903842F409573BDB716135
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 6772920cc0abc73eef31e9abe2a35c9ce4f0b29222ce395e4218e60bc1044fd8
MD5 39ddf7d72cab61194e08602adb1a5620
SHA1 fd3fdd654ea1b02f44fc1ae53b77b210ba81edb2
SHA512 fc6301e04f4912bfc6cc1a05d5a69a2c479bca852c8cd34f1c7a0dd4bdaf8e1d1471361b176d6e6894c03ab98392ab8239c8552b6ffb22f355b77a48ba9ebc5a
TLSH
T1A4E0C03411F6495EE5F9E0754BC5B82194AEF223041CD3B42FC49B08A703600DD03A79
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2CAWFFZ1\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows.exe

Path C:\WINDOWS\windows.exe
Size 55KB
SHA256 cea8456bd9ac6b3c4d6060a4eec3aaf4c655711d9a668a46a64311aa9682a59c
MD5 3b633dcb7adc59310172f5111efce358
SHA1 6992fddcd4b1f9ba00eb830f9d5c45c93eea9802
SHA512 332007e46984166a049d4d555aabebf1b65518b0e6b1fd32e71382cdc5bca303928eb19bc811522665ad49ed5d03d3e078e543cf2539f2a5934ed8230043964c
SSDEEP 1536:uhBZ1b9c409y1G1i35Bo01i/gcU8eVTOK/YqjYYamvbtb9:SZl2zoxV1i/NU82OMYcYYamv5b9
TLSH
T10D43F13AD629049AE3D5BE318CA66E30131BE3634032039F645CB476DDAF3533247768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system.exe

Path C:\system.exe
Size 55KB
SHA256 8b74c8d19dbfe525ead56fc2ef3bb9c8b1e21244c343d2560846a0e2598a6d1c
MD5 3ed5d398139f74665dd98788d51cb29d
SHA1 48c07d1877049770beffd88cdcfbd1e3796aa5eb
SHA512 e91fac60ab93ed26eeb1ee5b70165dbccc514f68fd1108581f62636504406f5970ec308beb0c2e1af8f71efa2e92531ea16a8b46134595fc208294c015da5931
SSDEEP 1536:nhBZ1b9c409y1G1i35Bo01i/gcU8eVTOK/YqjYYamvbtb9:/Zl2zoxV1i/NU82OMYcYYamv5b9
TLSH
T17043F13AD629049AE3E5BE318CA66E30131BE3634172039F649CB476DDAF3537247768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5036-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/5036-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download